Implemented session and account lockout management

Enabled account sync control and session expiration management
Applied some fixes to the govername page and project page

PostFundManagement.ConsoleUI/src/services/httpClient.ts

@@ -1,5 +1,6 @@
 import axios, { InternalAxiosRequestConfig } from 'axios';
 import { getApiBaseUrl } from '../config';
+import { triggerSessionExpired, isUserSyncEndpoint } from './sessionExpiration';
 
 export const BASE_API_URL = getApiBaseUrl();
 
@@ -15,14 +16,69 @@ export const apiClient = axios.create({
 
 // Request Interceptor to dynamically set baseURL and attach Bearer Token
 apiClient.interceptors.request.use(
-  (config: InternalAxiosRequestConfig) => {
+  async (config: InternalAxiosRequestConfig) => {
     // Dynamically synchronize baseURL from runtime configuration
     config.baseURL = getApiBaseUrl();
     const token = localStorage.getItem('pfm_access_token');
     if (token && config.headers) {
       config.headers.Authorization = `Bearer ${token}`;
     }
+
+    // User Sync Guard:
+    // All API calls require an authenticated and enabled user in the backend system.
+    const isSyncRequest = isUserSyncEndpoint(config.url);
+    if (token && !isSyncRequest) {
+      const { isUserSyncedInBrowser, isActivationPending, syncUserAccount } = await import('./userSyncService');
+
+      // If user account is flagged as pending administrator activation, block downstream API calls
+      if (isActivationPending()) {
+        return Promise.reject(new Error('User account is pending administrator activation'));
+      }
+
+      const storedSub = localStorage.getItem('pfm_user_sub') || '';
+      if (!isUserSyncedInBrowser(storedSub, token)) {
+        const syncRes = await syncUserAccount(storedSub, token);
+        if (!syncRes.success) {
+          return Promise.reject(new Error(syncRes.errorMessage || 'User account sync pending activation'));
+        }
+      }
+    }
+
     return config;
   },
   (error) => Promise.reject(error)
 );
+
+// Response Interceptor for global HTTP 401 detection
+apiClient.interceptors.response.use(
+  (response) => response,
+  (error) => {
+    if (error?.response?.status === 401) {
+      const requestUrl = error.config?.url;
+      const isSyncEndpoint = isUserSyncEndpoint(requestUrl);
+
+      // Disambiguation between Session Lockout and Session Expired:
+      // - Session Expired process monitors ALL OTHER endpoints for HTTP 401 other than the user sync endpoint.
+      // - User sync endpoint 401 is subordinated to the session lockout / auth initialization flow through call order and priority.
+      if (!isSyncEndpoint) {
+        // Active working endpoint returned HTTP 401: trigger modal with progress bar countdown and landing redirect
+        const detailMsg =
+          error?.response?.data?.detail ||
+          error?.response?.data?.message ||
+          'Authentication session expired or security token invalidated (HTTP 401).';
+
+        triggerSessionExpired(detailMsg, requestUrl);
+      } else {
+        // User sync endpoint returned HTTP 401: clean up session data silently for landing navigation
+        if (typeof window !== 'undefined') {
+          localStorage.removeItem('pfm_access_token');
+          localStorage.removeItem('pfm_access_user');
+          localStorage.removeItem('pfm_user_sync_record');
+          localStorage.removeItem('pfm_user_pending_activation');
+          localStorage.removeItem('pfm_user_pending_activation_reason');
+        }
+      }
+    }
+    return Promise.reject(error);
+  }
+);